How tracking pixels work
The classic pixel is a single transparent 1x1 GIF or PNG hosted on a tracking server. The webpage includes an <img> tag pointing at it, with query parameters identifying what to track:
<img src="https://tracker.com/pixel.gif?event=signup&user=abc123" width="1" height="1">
When the browser loads the image, it sends a request to the tracking server. The server logs the request (with all its parameters) and returns the 1x1 image. The user sees nothing. The platform now knows the user reached this page.
Modern pixels are usually JavaScript snippets rather than images. They do the same thing but can also read cookies, generate user IDs, batch events, and pass richer data. Meta Pixel, TikTok Pixel, Google's gtag, and most affiliate-network conversion pixels are all JS-based.
Where you'll encounter them
- Ad platform conversion tracking. Meta Pixel, TikTok Pixel, Google's conversion tag, LinkedIn Insight Tag, X Pixel — all fire on key pages (purchase confirmation, signup complete) so the platform can attribute the conversion to its ads.
- Affiliate-network conversion tracking. Some networks still use pixels on the merchant's "thank you" page to record commissions. Increasingly replaced by S2S postbacks.
- Email open tracking. The "we noticed you opened this email" mechanic uses an invisible image hosted on the sender's server; loading the image = open registered. Many privacy tools (Apple Mail Privacy Protection in particular) now block this.
- Analytics platforms. Google Analytics, Plausible, Fathom, Matomo — all use some form of pixel or JS beacon under the hood.
- Heatmap and session-replay tools. Hotjar, Microsoft Clarity, FullStory — heavier JS pixels that record behavior, not just events.
Why pixels are getting less reliable
Pixel tracking ran the digital ad world from roughly 2000 to 2020. Three forces have eroded reliability since:
- Safari ITP (Intelligent Tracking Prevention). Caps third-party cookie lifespan to 24 hours; some pixels stop functioning entirely.
- iOS App Tracking Transparency (ATT). Users have to opt-in to cross-app tracking. Most don't.
- Ad blockers. uBlock Origin, Brave, Firefox Enhanced Tracking Protection all block known tracking pixel domains by default. Estimates put global ad-block usage at 30–40% of internet users.
The result: most affiliate marketers now report 10–30% under-reporting on pixel-based conversion tracking. The conversions still happen — the pixel just doesn't fire to record them.
Pixel vs postback: when each makes sense
The fix for unreliable pixel tracking is server-to-server (S2S) postback tracking. Quick comparison:
- Pixel (client-side): fires from the user's browser. Vulnerable to ad blockers, ITP, ATT. Easy to set up — just paste a snippet.
- Postback (server-side): fires from the merchant's server directly to the network. Bypasses every browser-side block. Requires more technical setup — typically a click ID handoff between systems.
For most affiliate workflows in 2026, the right answer is both: keep the pixel for ad-platform optimization (Meta and TikTok still need their pixels to learn), and add S2S postbacks for accurate commission attribution. See S2S Tracking and Postback URL for the deeper picture.
Privacy and compliance
Pixels are personal-data collection. Under GDPR, CCPA, and similar laws, you typically need to disclose pixel usage in a privacy policy and (in the EU) gain consent before pixels that read or write cookies fire. Most cookie-consent platforms (Cookiebot, Osano, Termly, OneTrust) handle this by blocking pixel scripts until consent is given.
For US affiliates, the FTC requires disclosure of affiliate relationships but doesn't specifically regulate pixel use. State laws (California's CCPA, Virginia's VCDPA, Colorado's CPA) all impose disclosure obligations.